feat(orchestrator): enable per-build CPU/memory tracking for build sandboxes

[dobrac]

Summary

• Adds sandbox_type column (LowCardinality(String), default 'sandbox') to both sandbox_host_stats and sandbox_metrics_gauge ClickHouse tables to explicitly distinguish build vs runtime metrics
• Threads BuildID and SandboxType through RuntimeMetadata so build sandboxes are properly attributed to the overall build (not per-layer ephemeral IDs)
• Unifies cgroup setup across Factory.CreateSandbox and Factory.ResumeSandbox — build sandboxes now get full cgroup v2 CPU/memory accounting
• Initializes HostStatsCollector in CreateSandbox (feature-flag-gated via HostStatsEnabled)
• Enables envd metrics collection for CreateSandbox via MetricsWriteFlag feature flag
• Adds build_id and sandbox_type OTel attributes to the sandbox metrics observer, updates the materialized view to extract them

Files changed

New:

• packages/clickhouse/migrations/20260223120000_add_sandbox_type_to_host_stats.sql
• packages/clickhouse/migrations/20260223120001_add_build_columns_to_metrics_gauge.sql

Modified:

• packages/clickhouse/pkg/hoststats/hoststats.go — SandboxType field on SandboxHostStat
• packages/clickhouse/pkg/hoststats/delivery.go — sandbox_type in INSERT + Append
• packages/orchestrator/internal/sandbox/hoststats_collector.go — SandboxType on metadata + CollectSample
• packages/orchestrator/internal/sandbox/hoststats.go — reads SandboxType from RuntimeMetadata
• packages/orchestrator/internal/sandbox/fc/process.go — cgroupFD param on Process.Create()
• packages/orchestrator/internal/sandbox/sandbox.go — BuildID/SandboxType on RuntimeMetadata, cgroup + collector init in CreateSandbox, MetricsWriteFlag for CreateSandbox, updated ResumeSandbox
• packages/orchestrator/internal/metrics/sandboxes.go — build_id + sandbox_type OTel attributes
• packages/orchestrator/internal/template/build/layer/create_sandbox.go — passes TeamID/BuildID/SandboxType
• packages/orchestrator/internal/template/build/layer/resume_sandbox.go — passes TeamID/BuildID/SandboxType

Test plan

• Verify ClickHouse migrations apply cleanly (staging)
• Trigger a template build and confirm sandbox_host_stats rows appear with sandbox_type = 'build' and the correct sandbox_build_id
• Confirm regular sandbox metrics still have sandbox_type = 'sandbox' (or default)
• Verify sandbox_metrics_gauge rows for build sandboxes have build_id and sandbox_type populated
• Check that the HostStatsEnabled and MetricsWriteFlag feature flags gate the new behavior correctly

[claude]

sandbox_type is empty string for regular sandboxes: sbx.Runtime.SandboxType is only populated for build sandboxes (set in layer/create_sandbox.go and layer/resume_sandbox.go). For regular API-created sandboxes it remains "", so this emits sandbox_type="" into OTel metrics and therefore into sandbox_metrics_gauge — bypassing the DEFAULT 'sandbox' column default (the materialized view explicitly selects Attributes['sandbox_type'], so the default is never used).

This is inconsistent with hoststats.go, which falls back to SandboxTypeSandbox when runtime.SandboxType is empty. As a result, WHERE sandbox_type = 'sandbox' queries on sandbox_metrics_gauge will miss all regular sandbox rows.

Fix: apply the same fallback here, or set SandboxType: SandboxTypeSandbox in CreateSandbox/ResumeSandbox for the non-build path.

[dobrac]

Fixed: added a fallback in the OTel observer that defaults empty SandboxType to sandbox.SandboxTypeSandbox before emitting the attribute, consistent with hoststats.go.